We have a requirement to allow our users to submit information about their "projects" - a small piece of text and single image they upload. Ultimately we'll have a listing page of user contributed projects that others can comment on and rate.

We've decided to user Tridion's UGC for rating & comments site-wide for this first phase which has got me thinking - UGC is tied to Tridion published pages & components, if we want UGC on our user-submitted projects, they'll have to be created within Tridion as components themselves, not be sat in some custom db table?

Is this where the Core Service could come in? My understanding is that the CD Web Service is for retrieval, not for interacting with the Content Manager.

Is it OK (!) architecturally to expose the Core Service only to our live application servers so our backend .NET code can create "project components" that can be then be published by editors allowing them to be commented on?

Everything sounds pretty neat and tidy apart from the "exposing Core Service to live servers" bit. Without this though I'd have to write a custom way to "transfer" it back over to the Content Manager - maybe like Audience Manager Sync works?

Anyone done this before?


I would argue that it is Architecturally OK, but it might raise some security flags from an Infrastructure standpoint. However you should be able to lock down access to the core service so that is can only be accessed from a certain IP range, and you can run your scripts as a user with limited permissions.

  • 1
    I agree. Perhaps this is when all that gory WCF stuff actually becomes useful. You probably still want to model threats such as inappropriate end user content ending up on your site. – Dominic Cronin Dec 7 '12 at 19:05
  • We wouldn't publish new content. Just create components for editors to check, then publish. – Neil Dec 7 '12 at 21:29
  • Not much to add, so not adding my own answer: can be done, as Dom says, those nasty size restrictions on WCF config may come in handy finally, and all you need to consider is security - if your front-end servers are hacked you have exposed access to your CM via the webservice - assuming the hackers can understand WCF & Tridion (in which case you should hire them) – Nuno Linhares Dec 9 '12 at 17:40
  • 1
    Thanks. I guess the alternative is to persist user data within the live env. and then either allow secure access to editors so they can manually create content or custom sync this information back across. – Neil Dec 10 '12 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.